URL上的MVC凭证

Question

Using the MVC, In controller, how will I pass the values of credentials? Without placing the credentials as Query Parameters

// http://user1:pass1@localhost:80/GetData?Branch=1
public ActionResult GetPDF(int Branch) {
    // how will i get user1 as username, and pass1 as password?
}

Thanks

Answer 1

Make a Post request with mention your parameters in to the headers of ajax request, one can encode/encrypt as well.

greater than jQuery 1.5, you can $.ajaxsetup to set headers globally.

 $.ajax({  
url: 'url',  
type: "POST",  
contentType: "application/json",  
data: JSON.stringify(Data),  
dataType: "json",  
headers: { 'Authorization' :'Basic ' + Encode(username + ':' + password) },  
success: function (result) {  

},  
error: function (err) {  
    alert(err.statusText);  
}  });  

then into the controller put the authorization filter to decrypt and separate the credentials.

In case you want to access it through your controller action you can do something like this.

var re = Request;
var headers = re.Headers;

if (headers.Contains("Username"))
{
    string token = headers.GetValues("Username").First();
}

public class BasicAuthenticationAttribute : AuthorizationFilterAttribute

{

    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)

    {

        if (actionContext.Request.Headers.Authorization == null)

        {

            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);

        }

        else

        {

            // Gets header parameters

            string authenticationString = actionContext.Request.Headers.Authorization.Parameter;  


        string originalString = Encoding.UTF8.GetString(Convert.FromBase64String(authenticationString));   

        // Gets username and password  
        string usrename = originalString.Split(':')[0];  
        string password = originalString.Split(':')[1];    
        // Validate username and password  
        if (!ApiSecurity.VaidateUser(usrename, password))  
        {   // returns unauthorized error  
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);  
        }  
    }    
    base.OnAuthorization(actionContext);  
}  }  

this way you can authorize and authenticate the credentials without passing to data or url string.

Answer 2

使用POST请求，以便可以通过请求标头发送凭据